This content originally appeared on DEV Community and was authored by Daniel Parmenvik
Working with open source npm packages is so fast and easy that security and control is often pushed to the infamous "some other time" - or simply neglected.
But why? There are solutions that add security with almost no effort and without impacting developer performance! Watch the video below to see how easy it is.
Risks associated with using open source npm packages should not be overseen and the number of threats in the ecosystem only increases (like the much discussed dependency confusion). Not to mention that the potential impact on your business is catastrophic.
To take back control you should look into adding a private npm registry into your supply chain. And working with a private registry does not even have to impact your workflow. Simply configure the registry and use the private registry instead of using registry.npmjs.org directly.
Here's a video that shows you just how easy it is to work with secure private registries that are secure by default.
What is Bytesafe?
Want to block or quarantine packages that contain vulnerabilities? Need to make sure that your apps don’t depend on code that doesn't fulfill your business policies? Or maybe you’re looking for hosted secure private registries to be able to share packages and collaborate?
"Inga problem", as we say in Swedish = Not a problem.
Bytesafe is a devtool that makes life easier to trust code you are dependant on by:
- Controlling what packages and dependencies are being used in applications and securing workflows for both internal and external packages
- Knowing what security and open source license issues exist in the code you depend on so that they can be remediated
- Protecting the business from unintended packages entering the software development lifecycle (dependency confusion) - working like a dependency firewall
This content originally appeared on DEV Community and was authored by Daniel Parmenvik
Daniel Parmenvik | Sciencx (2021-06-10T12:57:25+00:00) How to use secure private npm registries. Retrieved from https://www.scien.cx/2021/06/10/how-to-use-secure-private-npm-registries/
Please log in to upload a file.
There are no updates yet.
Click the Upload button above to add an update.